CVE-2021-35503
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
Afian FileRun 2021.03.26 is vulnerable to stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs. An attacker can inject malicious JavaScript code.
Risk Assessment
The risk involves arbitrary JavaScript execution in browsers of administrators viewing activity logs, potentially leading to session theft, account takeover, or data exfiltration.
Recommendation
Update Afian FileRun to the latest patched version immediately. Until then, restrict access to activity logs to trusted administrators only.
Other vulnerabilities in Afian FileRun
See all- CVE-2021-35506Medium
An XSS vulnerability in Afian FileRun 2021.03.26 allows an attacker to inject malicious scripts when an administrator uses the HTML Editor to preview or edit a crafted document.
- CVE-2021-35505High
A vulnerability in Afian FileRun 2021.03.26 allows remote code execution by administrators via the Check Path value for the magick binary.
- CVE-2021-35504High
A vulnerability in Afian FileRun 2021.03.26 allows remote code execution by administrators via the Check Path value for the ffmpeg binary.
Original NVD description (English source)
Afian FileRun 2021.03.26 allows stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS